CN112469468A

CN112469468A - Safety key electronic equipment lock

Info

Publication number: CN112469468A
Application number: CN201980048876.4A
Authority: CN
Inventors: H·C·埃德尔; M·特里尤
Original assignee: Cochlear Ltd
Current assignee: Cochlear Ltd
Priority date: 2018-09-12
Filing date: 2019-09-06
Publication date: 2021-03-09
Also published as: WO2020053725A1; US20210268265A1

Abstract

Presented herein are techniques for electronically locking an electronic device in response to detecting a safety critical failure. As used herein, a "safety critical fault" is a fault that may cause injury to an individual using the device. In particular, an electronic device according to some embodiments presented herein is configured to determine when the electronic device has experienced a safety critical failure. In response, the electronic device automatically restarts itself, and after the restart, is automatically forced into a locked mode. The locked mode prevents execution of runtime programs stored in the electronic device.

Description

Safety key electronic equipment lock

Technical Field

The present invention relates generally to techniques for electronically locking a device in response to a safety critical failure.

Background

Individuals use a variety of electronic devices such as televisions, computers, mobile computing devices, and the like on a daily basis. The subset of individuals uses a particular type of electronic device called a medical device. A medical device is an electronic device that performs one or more medical functions. For example, in recent decades, medical prostheses/devices having one or more implantable components (collectively referred to herein as implantable medical prostheses) have provided a wide range of therapeutic benefits to device recipients (i.e., the individuals in which the components are implanted). In particular, partially or fully implanted medical prostheses, such as auditory prostheses (e.g., bone conduction devices, mechanical stimulators, cochlear implants, etc.), implantable pacemakers, defibrillators, functional electrical stimulation devices, and other implantable medical devices, etc., have been successful in performing life saving and/or improving lifestyle functions for many years.

Over the years, the types of implantable medical prostheses and the range of functions performed thereby have increased. For example, many implantable medical prostheses now typically include one or more instruments, devices, sensors, processors, controllers, or other functional mechanical or electrical components that are permanently or temporarily implanted in a recipient. These functional devices are commonly used to diagnose, prevent, monitor, treat, or manage a disease/injury or symptom thereof, or to study, replace, or modify anatomical structures or physiological processes. Many of these functional devices utilize power and/or data received from an external device that operates as part of or in conjunction with an implantable medical prosthesis.

Disclosure of Invention

In one aspect, a method is provided. The method comprises the following steps: determining, using an implantable component of a medical device, that the implantable component has experienced a safety-critical failure; and automatically restarting the implantable component; and automatically forcing the implantable component into a locked mode after restarting the implantable component, wherein the locked mode prevents execution of a runtime program stored in the implantable component.

In another aspect, an electronic device is provided. The electronic device includes a non-volatile memory (NVM), the NVM configured to store a runtime program; and at least one processor configured to execute a runtime program, wherein executing the runtime program detects a safety-critical failure in operation of the electronic device and intentionally destroys the NVM; restarting the electronic device and initiating a lockout mode, wherein the lockout mode includes verification of the NVM of the device; determining that the NVM is damaged; and preventing re-execution of the runtime program in response to determining that the NVM is corrupted.

In another aspect, one or more non-transitory computer-readable storage media encoded with instructions are provided. When the one or more non-transitory computer-readable storage media are executed by the processor, the instructions cause the processor to: determining, using data from an integrated diagnostic facility of an electronic device, that the electronic device has experienced a safety critical failure; automatically restarting the electronic device; determining whether a non-volatile memory (NVM) of an electronic device is damaged; and responsive to determining that the NVM is corrupted, infinitely executing code stored in a Read Only Memory (ROM) of the electronic device.

Drawings

Various embodiments of the present invention are described herein with reference to the accompanying drawings, in which

Fig. 1 is a block diagram illustrating a cochlear implant according to some embodiments presented herein;

FIG. 2 is a schematic block diagram of a processing unit in accordance with certain embodiments presented herein;

FIG. 3 is a detailed flow diagram of a method according to certain embodiments presented herein;

FIG. 4 is a timeline illustrating a sequence of certain operations performed in the method of FIG. 3 in accordance with certain embodiments presented herein;

fig. 5 is a schematic block diagram illustrating a spinal cord stimulator, according to certain embodiments presented herein; and

fig. 6 is a flow diagram of a method according to some embodiments presented herein.

Detailed Description

For ease of description only, the techniques presented herein are described herein primarily with reference to one illustrative electronic device (i.e., an implantable medical prosthesis referred to as a cochlear implant). However, it should be appreciated that the techniques presented herein may also be used with a variety of other electronic devices that may be subject to safety critical failures (such as implantable components of medical prostheses that provide a wide range of therapeutic benefits to a recipient). For example, it should be appreciated that the techniques presented herein may be used with auditory prostheses other than cochlear implants, including acoustic hearing aids, auditory brainstem stimulators, bone conduction devices, middle ear auditory prostheses, direct acoustic stimulators, bi-modal auditory prostheses, bilateral auditory prostheses, and the like, as well as other implantable components such as implantable pacemakers, spinal cord stimulators, deep brain stimulators, motor cortex stimulators, sacral nerve stimulators, pudendal nerve stimulators, vagus nerve stimulators, trigeminal nerve stimulators, retinal or other visual prostheses/stimulators, occipital cortex implants, diaphragm (septal) pacemakers, analgesic stimulators, other neural or neuromuscular stimulators, and the like.

Fig. 1 is a schematic diagram of an exemplary cochlear implant 100, the exemplary cochlear implant 100 being configured to implement various aspects of the techniques presented herein. Cochlear implant 100 includes an external component 102 and an internal component/implantable component (implant) 104. The external component 102 is configured to be attached directly or indirectly to the recipient's body, and typically includes an external coil 106, and typically includes a magnet (not shown in fig. 1) that is fixed relative to the external coil 106. The external part 102 also comprises a sound processing unit 112.

The sound processing unit 112 includes one or more sound input devices for receiving sound signals. Fig. 1 illustrates one example sound input device, namely, a microphone 108. However, it should be appreciated that additional microphones and additional types of sound input devices (e.g., telecoil, etc.) may also be included in the sound processing unit 112. The sound processing unit 112 also includes a sound processor 109 and a Radio Frequency (RF) transceiver 110.

The implantable component 104 includes an implant body (main module) 114, a lead region 116, and an intracochlear stimulation assembly 118, all configured to be implanted under the recipient's skin/tissue (tissue) 105. The implant body 114 generally includes a hermetically sealed housing 115, with the RF interface circuitry 124, the implant processing unit 125, the battery 129, and the stimulator unit 130 disposed in the housing 115. The implant body 114 also includes an internal/implantable coil 122, which is typically external to the housing 115, but is connected to RF interface circuitry 124 via a hermetic feedthrough (not shown in fig. 1).

As noted, the stimulating assembly 118 is configured to be at least partially implanted in a recipient's cochlea (not shown in fig. 1). Stimulation assembly 118 includes a plurality of longitudinally spaced intracochlear electrical stimulation contacts (electrodes) 126 that collectively form a contact or electrode array 128 for delivering electrical stimulation (current) to the recipient cochlea. The stimulating assembly 118 extends through an opening in the recipient's cochlea (e.g., a cochleostomy, a round window, etc.) and has a proximal end connected to the stimulator unit 120 via the lead region 116 and an air-tight feedthrough (not shown in fig. 1). The lead region 116 includes a plurality of conductors (wires) that electrically couple the electrodes 126 to the stimulator unit 120.

As noted, cochlear implant 100 includes external coil 106 and implantable coil 122.

Coils

106 and 122 are typically wire antenna coils each consisting of multiple turns of electrically insulated single or multiple strands of platinum or gold wire. Typically, the magnet is fixed relative to each of the external coil 106 and the implantable coil 122. A magnet fixed relative to the external coil 106 and the implantable coil 122 facilitates operational alignment of the external coil with the implantable coil. This operational alignment of the

coils

106 and 122 enables the external component 102 to transfer data and possibly power to the implantable component 104 via the tightly coupled wireless link 123 formed between the external coil 106 and the implantable coil 122. In some examples, the tightly coupled wireless link 123 is a Radio Frequency (RF) link. However, various other types of energy transfer, such as Infrared (IR) transmission, electromagnetic transmission, capacitive transmission, and inductive transmission, may be used to transfer power and/or data from an external component to an implantable component, as such, fig. 1 illustrates only one example arrangement.

As noted above, the sound processing unit 112 includes a sound processor 133, the sound processor 133 configured to convert the input audio signal into a stimulation control signal for stimulating the recipient's first ear (i.e., the sound processor 133 is configured to perform sound processing on the input audio signal received at the sound processing unit 112. in other words, the sound processor 133 (e.g., one or more processing elements implementing firmware, software, etc.) is configured to convert the captured input audio signal into a stimulation control signal representative of electrical stimulation for delivery to the recipient.

In the embodiment of fig. 1, the stimulation control signals generated by sound processor 109 are provided to RF transceiver 110, which RF transceiver 110 transcutaneously communicates the stimulation control signals (e.g., in an encoded manner) to implantable component 104 via external coil 106 and implantable coil 122. That is, stimulation control signals are received at the RF interface circuit 124 via the implantable coil 122 and provided to the stimulator unit 120. Stimulator unit 120 is configured to utilize the stimulation control signals to generate electrical stimulation signals (e.g., current signals) for delivery to the recipient's cochlea via one or more stimulation contacts 126. In this way, cochlear implant 100 electrically stimulates the recipient's auditory nerve cells, thereby bypassing missing or defective auditory hair cells, which typically convert acoustic vibrations into neural activity in a manner that causes the recipient to perceive one or more components of the input audio signal.

As noted above, the implantable component 104 further includes an implant processing unit 125. Generally, the implant processing unit 125 is configured to initiate and control the operation of the implantable component 104. Additionally, the implantable component 104 is configured to implement a diagnostic safety mechanism for the implantable component and, as described below, electronically "locks" the implantable component when a safety critical fault is detected.

More specifically, the implant processing unit 125 implements one or more diagnostic safety mechanisms that are activated when the recipient is using the implantable component. These diagnostic safety mechanisms may be configured to, for example, monitor for short circuit conditions at the implant electronics and/or electrode array 128, monitor for the battery 129 (e.g., monitor to determine if a maximum battery voltage threshold has been reached/exceeded, monitor for a battery overcharge condition, etc.), monitor for faults in the voltage measurement system, monitor for electrical leakage to tissue, monitor for memory hard errors, etc.

According to certain embodiments presented herein, when these diagnostic safety mechanisms of the implant processing unit 125 detect a failure in the operation of the implantable component 104, the implant processing unit 125 is configured to perform a reset of the implantable component to ensure that the implantable component stops operating immediately and is in a safe state (i.e., a state in which any potential risks/dangers to the recipient are remedied). Repositioning of the implantable component can be accomplished in a number of different ways. In one example, the reset disconnects all electrodes from the tissue, stops/terminates all processing, and disconnects the internal battery 129 from another internal circuitry (thereby powering down the implant if external power is not supplied).

After the reset, the implant processing unit 125 restarts the operation and determines the cause of the reset. If the implant processing unit 125 determines that the cause of the reset is a "safety critical failure" (i.e., a failure/condition that creates a potentially risky situation for the recipient), the implant processing unit 125 is configured to initiate another reset and cause the implantable component to enter an electronic "locked mode" in which only basic non-risky functionality is supported. The functionality may include, for example, the ability to allow interrogation of the internal memory of the implantable component and unlocking of the implantable component. This unlocking is only allowed to be done in, for example, a clinic after a trained clinician or engineer has assessed the risk associated with the failure that triggered the safety check. Further details regarding the electronic locking of the implantable component 104 are described below with reference to fig. 2 and 3.

More specifically, fig. 2 is a functional diagram illustrating one embodiment of the implant processing unit 125 of fig. 1, and fig. 3 is a detailed flow chart illustrating a method 160 for operating the implant processing unit 125 according to some embodiments herein.

Referring first to fig. 2, the implant processing unit 125 includes a Read Only Memory (ROM)150, a program memory/Random Access Memory (RAM)152, a non-volatile memory (NVM)154, and at least one processor (e.g., microprocessor, microcontroller, etc.) 156. ROM 150 includes code 151, sometimes referred to herein as ROM code or boot code (e.g., hardwired into an ASIC). NVM 154 includes a runtime program 159, an implant lock memory block 157, and a failure information memory block 158.

Referring next to fig. 3, a method 160 begins at 162, with the implantable component 104 being started or restarted (i.e., powered on/powered on). For example, the implantable component 104 can be powered on in response to a command received from the sound processing unit 112 or another external device (e.g., in response to a button press at the external device, in response to detecting the presence/proximity of the external device relative to the implantable component, etc.). At 164, ROM code 151 in ROM 150 is executed by the at least one processor 156 in response to the implantable component 104 being powered on. The at least one processor 156 executes ROM code 151 referred to herein as the "ROM mode" of the implantable component 156.

When executed by the at least one processor 156, the ROM code 151 is configured to: verification of the NVM 154 is performed, among other operations. That is, at 168, the ROM code 151 is configured to determine whether the NVM is valid or corrupted (e.g., including any corrupted memory blocks). For example, the ROM code 151 may be configured to perform a check of a Cyclic Redundancy Check (CRC) on the NVM 154.

If at 168, the ROM code 151 determines that the NVM 154 is invalid/corrupted (i.e., includes one or more corrupted memory blocks), the implantable component 104 remains in ROM mode indefinitely, as indicated by arrow 165. This will be described further below.

If the ROM code 151 is able to successfully authenticate the NVM 154 at 168, then at 170, a runtime program 159 is loaded from the NVM 154 into the program memory 152 and executed by the at least one processor 156. This is illustrated in fig. 2 by arrow 155.

As used herein, the runtime program 159 refers to a set of code, instructions, etc., that when executed by the at least one processor 156, enables the implantable component 104 to perform its intended operational functions. In the particular case of the implantable component 104, these intended operational functions include, among other operations, receiving stimulation commands from the sound processing unit 112 and delivering electrical stimulation signals to the recipient via the electrodes 126. Thus, if the NVM 154 is not damaged, the implantable component 104 exits ROM mode and enters "run-time mode" or "run-time state".

When the runtime program 159 is loaded and first executed by the at least one processor 156, at 172, it is determined whether the implantable component 104 is powered up due to a reset in response to a safety critical failure. This determination may be made by checking the transient reset register 153. These transient reset registers 152 are part of or used by the diagnostic safety mechanism (running as part of the runtime program 159) to immediately store information associated with the detected fault. These transient reset registers 153 are not reset/erased in response to a reset of the implantable component. As such, these transient reset registers 153 may be interrogated by the runtime program 159 at 172 to determine the cause of the fault, and thus the cause of the reset. However, these transient reset registers 153 cannot be read by an external device and are continuously updated with various information so that any information stored therein will be cleared within a certain period of time.

This determination is made by the initial/preliminary code (i.e., the first few lines of code) of the runtime program 159 and is itself one of the first operations that the implantable component performs in runtime mode. More specifically, the determination may be made prior to exposure of the recipient to any potentially risky condition, such as prior to delivery of the stimulus to the recipient. Additionally, the determination may be made prior to connecting the battery, prior to performing a battery voltage or current measurement, and prior to enabling the microphone.

In a situation where the implantable component 104 is normally powered up (e.g., in response to an instruction/command received from the sound processing unit 112), then the implantable component 104 determines that the reboot (or start in the earliest instance) is not due to a reset and the method proceeds to 174. Additionally, in some cases, implantable component 104 may determine that the implantable component is powered up after a reset, but that the reset is due to a so-called "unclassified fault" or a "non-safety-critical fault" determined from transient reset register 153. Again, in this case, the method proceeds to 174 (i.e., a failure of unknown origin).

At 174, the implantable component 104 operates in a runtime mode (i.e., provides full functionality of the implantable component) until a fault is detected at 176 or the implantable component is powered down via normal procedures (not shown in fig. 3). If a fault is detected at 176, the implantable component 182 is substantially immediately reset at 182 to place the implantable component in a safe state in which any potential risks/hazards to the recipient are remedied. Further details regarding fault detection are described below.

As noted above, the implantable component is reset at 182 substantially immediately after the fault is detected at 176. In particular, at this stage, information about the fault is not stored in the fault information memory block 158 (i.e., the fault suffered is an unclassified fault). One reason for resetting the implantable component substantially immediately after detecting the fault at 176 at 182 is to avoid any unnecessary processing when the implantable component is potentially in an unsafe condition.

After resetting the implantable component, method 160 returns to 164. That is, the reset causes the implantable component to restart in the ROM mode. As noted, when in ROM mode, the implantable component 104 is configured to determine whether the NVM is valid or corrupted (e.g., performing a CRC check on the NVM 154). At this point, the implantable component 104 has not performed any operations to alter the validity of the NVM 154 since the fault that caused the last reset was an unclassified fault. As such, the method proceeds to 170, where the runtime program 159 is loaded from the NVM 154 into the program memory 152 and executed by the at least one processor 156. Again, this is illustrated in FIG. 2 by arrow 155.

As noted above, when the runtime program 159 is loaded and first executed by the at least one processor 156, at 172, it is determined whether the implantable component 104 is powered on due to a reset in response to a safety critical failure. This determination may be made again by checking the transient reset register 153.

As noted, the determination at 172 is made by the initial/preliminary code (i.e., the first few lines of code) of the runtime program 159, and is itself one of the first operations that the implantable component performs in runtime mode (i.e., before the recipient is exposed to any potential risk condition, such as before a stimulus is delivered to the recipient).

If the implantable component 102 is reset due to a non-safety critical fault at 172, the implantable component 104 operates in a runtime mode at 174 until another fault is detected at 176 or the implantable component is powered down via normal procedures. However, if it is determined at 172 that the fault suffered by the implantable component 104 is a safety critical fault, at 178, the implantable component 104 stores information about the fault (e.g., information about the cause, reason, and/or type of the fault) in the fault information memory block 158 of the NVM 154. Additionally, at 180, the implantable component 104 intentionally damages the implant locked memory block 157. That is, the implant locked memory block 157 is a dedicated memory block added to the NVM 154 for the purpose of being corrupted upon detection of a safety critical failure of the implantable component 104. As described further below, damaging implant locked memory block 157 in NVM 154 damages/invalidates NVM 154.

After the information about the cause of the failure has been stored in failure information memory block 158 (at 178) and implant lock memory block 157 has been compromised (at 180), implantable component 182 is reset at 182. One reason that the operations of 178 and 180 may be performed at this time is that the safety critical failure 172 is detected at the beginning of the runtime mode (i.e., before full functionality is enabled). Thus, the additional processing at this point does not pose a risk to the recipient.

After resetting the implantable component at 180, method 160 again returns to 164 (i.e., the implantable component restarts again in ROM mode). As noted, while in ROM mode, the implantable component 104 is configured to determine at 168 whether the NVM 154 is valid or corrupted (e.g., performing a CRC check on the NVM 154). At this point, the implantable component 104 performs an operation at 180 to intentionally damage the implant locked memory block 157 since the fault that caused the last reset had previously been determined to be a safety critical fault. Thus, in this case, the ROM code 151 determines that the NVM 154 is invalid/corrupted (i.e., includes a corrupted implant locked memory block 157) at 168. Thus, the implantable member 104 remains in ROM mode indefinitely, as indicated by arrow 165.

At 166, the implantable component 104 remains in the ROM mode until the implantable component 104 is positively unlocked. The implantable component 104 can be unlocked, for example, via a command received from an external device, such as a computing device or an adaptation system used by a clinician. In other words, if the NVM 154 is corrupted (i.e., one or more memory blocks included therein are corrupted), the implantable component 104 will not, and cannot, exit ROM mode without receiving a command from an external device. Maintaining the implantable component 104 in the ROM mode is sometimes referred to as a "locked mode" or "locked state" of the implantable component 104. When the implantable component 104 is in this locked mode, the implantable component can perform only a limited function. These limited functions may include: only limited read and write functionality from the auxiliary device to the NVM 154 of the implantable component 104 is allowed (i.e., interrogation of the implantable component is enabled, allowing the clinician or other individual to determine what condition caused the lock), allowing the clinician or other individual to unlock the implant, and allowing the clinician or other individual to reprogram the NVM 154 with new firmware.

FIG. 4 is an element-free timeline 183 illustrating the sequence of operations performed in the above example of FIG. 3. The timeline 183 of fig. 4 begins at 174, and at 174, the implantable component 104 operates normally in a runtime mode (i.e., not after a fault-triggered reset).

As noted above, when a safety critical failure is detected, the implantable component 104 is electronically locked to ensure that the implantable component will not, and cannot continue to, operate in the event of the failure. The electronic locking mechanism described herein may, for example, prevent more serious consequences due to malfunction and ensure that the recipient visits a clinic where the condition leading to locking can be properly evaluated and a decision can be made regarding future use of the implant. As noted above, a safety critical fault is a fault that may cause injury to the individual using the device (i.e., the recipient in the case of an implantable component).

As noted above, a device configured to implement the techniques presented herein (such as the implantable component 104) is also configured to implement one or more diagnostic safety mechanisms that are activated when the individual is using the device. These diagnostic safety mechanisms are configured to detect the occurrence of faults and, where appropriate, store information about these faults. In the particular case of implantable components, one example of a safety critical fault that may be detected by these diagnostic safety mechanisms may be a short circuit condition of the implant electronics and/or the implanted electrode array (e.g., determined by examining the battery discharge current). Another example of a safety critical fault that may be detected by these diagnostic safety mechanisms is a condition in which the voltage of the implanted battery has reached or exceeded a maximum battery voltage threshold (e.g., determined by directly measuring the battery voltage and/or measuring the battery charging current). Another example of a safety critical fault that may be detected by these diagnostic safety mechanisms is a condition in which the implanted battery has been overcharged (i.e., a battery overcharge condition, which is determined by measuring the battery voltage and/or measuring the battery charge current). Another example of a safety critical fault that may be detected by these diagnostic safety mechanisms is a condition in which the voltage measurement system of the implantable component has an error (e.g., determined by checking whether a voltage that is not likely to be present within the system can be measured). Yet another example of a safety-critical fault that may be detected by these diagnostic safety mechanisms is a condition in which there is electrical leakage to the recipient's tissue (e.g., determined by checking whether electrodes in the tissue are pulled toward an uncontrolled potential). Another example of a safety critical fault that may be detected by these diagnostic safety mechanisms is a condition in which the memory of the implantable component has experienced a hard fault/error (e.g., determined by periodically reading back blocks in the program memory after they have been loaded from the NVM and performing a CRC on the read back blocks of the program memory). It should be appreciated that the safety-critical faults described above are illustrative of the type of safety-critical fault and do not represent an exhaustive list of safety-critical faults that may be detected according to embodiments presented herein. In fact, different devices may have different types of failures altogether, which may be considered safety critical, resulting in an electronic locking device.

The various embodiments presented herein are described primarily with reference to cochlear implants, and in particular, fig. 1-4 have been generally described with reference to one example arrangement of cochlear implants configured to implement the presented techniques. However, as noted elsewhere, the techniques presented herein may also or alternatively be used with other types of cochlear implants and other types of electronic devices that may be subject to safety critical failures (such as implantable components of medical prostheses that provide a wide range of therapeutic benefits to the recipient). For example, it should be appreciated that the techniques presented herein may be used with auditory prostheses other than cochlear implants, including acoustic hearing aids, auditory brainstem stimulators, bone conduction devices, middle ear auditory prostheses, direct acoustic stimulators, bi-modal auditory prostheses, bilateral auditory prostheses, and the like, as well as other implantable components such as implantable pacemakers, spinal cord stimulators, deep brain stimulators, motor cortex stimulators, sacral nerve stimulators, pudendal nerve stimulators, vagus nerve stimulators, trigeminal nerve stimulators, retinal or other visual prostheses/stimulators, occipital cortex implants, diaphragm (septal) pacemakers, analgesic stimulators, other neural or neuromuscular stimulators, and the like.

For example, fig. 5 is a simplified schematic diagram illustrating a spinal cord stimulator 500 in which certain embodiments presented herein may be implemented.

More specifically, spinal cord stimulator 500 includes a stimulation component 518 implanted under the recipient's skin/tissue (tissue) and an implant body (main module) 514. The implant body 514 generally includes a hermetically sealed housing 515, with the implant processing unit 525, the battery 529, and the stimulator unit 530 disposed in the housing 515. The implant body 514 also includes a communication mechanism 524 for communicating within an external device. The communication mechanism 524 may include, for example, a wireless transceiver, an internal/implantable coil, and RF interface circuitry, among others.

Stimulation component 518 is implanted within the recipient at a location adjacent to/proximate to recipient spinal cord 527 and includes five (5) stimulation electrodes 526, referred to as stimulation electrodes 526(1) through 526 (5). Stimulation electrodes 526(1) through 526(5) are disposed in electrical insulator 584 and are electrically connected to stimulator 530 via conductors (not shown) extending through electrical insulator 584.

After implantation, the implant processing unit 525 is configured to generate stimulation signals for delivery to the spinal cord 527 via stimulation electrodes 526(1) -526 (5). Although not shown in fig. 5, an external controller may also be provided to transmit signals through the recipient's skin/tissue to the implant processing unit 525 in order to control the stimulation signals.

Similar to the embodiments described above, the implant processing unit 525 is configured to implement one or more diagnostic safety mechanisms that are activated when the recipient is using the implantable component. These diagnostic safety mechanisms may be configured to, for example, monitor for short circuit conditions at the implant electronics and/or electrode array 528, monitor the battery 529 (e.g., monitor to determine if a maximum battery voltage threshold has been reached/exceeded, monitor for a battery overcharge condition, etc.), monitor for faults in the voltage measurement system, monitor for electrical leakage to tissue, monitor for memory hard errors, etc.

According to certain embodiments presented herein, when these diagnostic safety mechanisms of the implant processing unit 525 detect a failure in the operation of the spinal cord stimulator 500, the implant processing unit 125 is configured to perform a reset of the spinal cord stimulator 500 to ensure that the spinal cord stimulator immediately ceases operation and is placed in a safe state (i.e., a state in which any potential risks/dangers to the recipient are remedied). Resetting of the spinal cord stimulator 500 can be accomplished in several different ways. In one example, the reset disconnects all electrodes from the tissue, stops/terminates all processing, and disconnects the internal battery 529 from other internal circuitry (de-energizes the implant if external power is not supplied).

After the reset, the implant processing unit 525 restarts the operation and determines the cause of the reset. If the implant processing unit 525 determines that the cause of the reset is a "safety critical failure" (i.e., a failure/condition that poses a potentially risky situation to the recipient), the implant processing unit 525 is configured to initiate another reset and cause the implantable component to enter an electronic "locked mode" in which only basic non-risky functionality is supported. The functionality may include, for example, allowing interrogation of the internal memory of the implantable component and the ability to unlock the implantable component. Unlocking may only be allowed to occur after a trained clinician or engineer has assessed the risk associated with the fault triggering the safety check, for example in a clinic. Further details regarding the electronic locking of implantable components such as spinal cord stimulator 500 have been described further below with reference to fig. 2 and 3. In other words, the implant processing unit 525 may be configured to operate in a similar manner as the implant processing unit 125 described above with reference to fig. 2 and 3.

Fig. 6 is a flow chart of a method 690 according to embodiments presented herein. The method 690 begins at 691 where an implantable component of the medical device determines that the implantable component has experienced a safety critical failure at 691. At 692, the implantable component automatically restarts the implantable component. At 694, after restarting the implantable component, the implantable component is forced into a locked mode, wherein the locked mode prevents execution of the runtime program stored in the implantable component.

As detailed above, presented herein are techniques for implementing an electronic "locked mode" within an electronic device, such as in an implantable medical component (implantable component). In particular, the techniques presented herein configure the implantable component such that if a fault of a severe nature (i.e., a safety-critical fault) is detected, the implantable component immediately ceases normal operation and transitions to a locked mode with minimal operation (e.g., possibly including disconnecting all electrodes from the block, stopping all processing, and disconnecting the internal battery from the internal circuitry). The recipient may then, for example, visit a clinic for problem diagnosis.

It should be appreciated that the embodiments described above are not mutually exclusive and that the various embodiments may be combined in various ways and arrangements.

The scope of the invention described and claimed herein is not limited by the particular preferred embodiments disclosed herein, since these embodiments are intended as illustrations of several aspects of the invention and not as limitations. Any equivalent embodiments are intended to be within the scope of the present invention. Indeed, various modifications of the invention in addition to those shown and described herein will become apparent to those skilled in the art from the foregoing description. Such modifications are also intended to fall within the scope of the appended claims.

Claims

1. A method, comprising:

determining, using an implantable component of a medical device, that the implantable component has experienced a safety-critical failure;

automatically restarting the implantable component; and

automatically forcing the implantable component into a locked mode after restarting the implantable component,

wherein the locked mode prevents execution of a runtime program stored in the implantable component.

2. The method of claim 1, wherein the locked mode allows only limited read and write functionality from an auxiliary device to a memory of the implantable component.

3. The method of claim 1, wherein automatically forcing the implantable component into the locked mode comprises:

restarting the implantable component such that the implantable component executes code stored in a Read Only Memory (ROM) of the implantable component, wherein executing the code stored in the ROM checks a non-volatile memory (NVM) of the implantable component for corrupted memory blocks;

determining that a memory block in the NVM is defective;

responsive to determining that the memory block in the NVM is corrupted, the code stored in the ROM is executed indefinitely.

4. The method of claim 3, wherein determining that the memory block in the NVM is defective comprises:

performing a check of a Cyclic Redundancy Check (CRC) on the NVM.

5. The method of claim 1, wherein prior to determining that the implantable component has experienced the safety critical fault, the method comprises:

determining that the implantable component has experienced an unclassified fault;

executing the code stored in the ROM without detecting any corrupted memory blocks;

loading the runtime program into a program memory for execution; and

after executing the runtime program, determining the unclassified fault as a safety-critical fault.

6. The method of claim 5, wherein in response to determining that the unclassified fault is a safety-critical fault, the method comprises:

storing an indication of the failure in the NVM; and

damaging a dedicated memory block in the NVM prior to automatically restarting the implantable component.

7. The method of claim 1, wherein detecting a safety critical fault comprises:

detecting a short circuit condition in the implantable component.

8. The method of claim 1, wherein the implantable component comprises an implantable battery, and wherein detecting a safety critical fault comprises:

detecting that a voltage of the implantable battery has reached a maximum voltage threshold, or detecting that the implantable battery has been overcharged.

9. An electronic device, comprising:

a non-volatile memory NVM configured to store a runtime program; and

at least one processor configured to:

executing the runtime program, wherein executing the runtime program detects a safety critical failure in operation of the electronic device and damages the NVM;

restarting the electronic device and initiating a lockout mode, wherein the lockout mode includes verification of the NVM of the device;

determining that the NVM is damaged; and

preventing re-execution of the runtime program in response to determining that the NVM is corrupted.

10. The electronic device of claim 9, wherein the locked mode allows only limited read and write functions from an auxiliary device to the NVM.

11. The electronic device of claim 9, wherein to verify the NVM of the device, the processor is configured to perform a check of a Cyclic Redundancy Check (CRC) on the NVM.

12. The electronic device of claim 9, wherein prior to determining that the electronic device has experienced the safety critical failure, the processor is configured to:

determining that the electronic device has experienced an unclassified fault;

in response to determining that the electronic device has experienced the unclassified fault, restarting the electronic device and executing code stored in a read-only memory (ROM) of the electronic device;

verifying the NVM;

upon successful verification of the NVM, loading the runtime program into a program memory for execution; and

13. The electronic device of claim 12, wherein in response to determining that the unclassified fault is a safety-critical fault, the processor is configured to:

storing an indication of the failure in the NVM; and

damaging the dedicated memory block in the NVM prior to restarting the electronic device.

14. The electronic device of claim 9, wherein to prevent re-execution of the runtime program, the processor continuously executes code stored in a read-only memory ROM of the electronic device.

15. The electronic device of claim 9, wherein the electronic device is an implantable component of a medical device, and wherein the NVM and the at least one processor are configured to be implanted within a recipient of the implantable component.

16. One or more non-transitory computer-readable storage media encoded with instructions that, when executed by a processor, cause the processor to:

determining, using data from an integrated diagnostic facility of an electronic device, that the electronic device has experienced a safety critical fault;

automatically restarting the electronic device;

determining whether a non-volatile memory (NVM) of the electronic device is damaged; and

responsive to determining that the NVM is compromised, code stored in a read-only memory ROM of the electronic device is executed indefinitely.

17. The non-transitory computer-readable storage medium of claim 16, wherein the instructions that cause the processor to execute code stored in the ROM of the electronic device indefinitely comprise instructions that cause the processor to:

preventing execution of a runtime program stored in the NVM of the electronic device.

18. The non-transitory computer-readable storage medium of claim 16, wherein the instructions that cause the processor to execute code stored in the ROM of the electronic device indefinitely comprise instructions that cause the processor to:

only limited read and write functions of the NVM from an auxiliary device to the electronic device are allowed.

19. The non-transitory computer-readable storage medium of claim 16, wherein the instructions that cause the processor to execute code stored in the ROM of the electronic device indefinitely comprise instructions that cause the processor to:

20. The non-transitory computer-readable storage medium of claim 16, wherein the instructions that cause the processor to determine whether the NVM of the electronic device is damaged comprise instructions that cause the processor to:

performing a check of a Cyclic Redundancy Check (CRC) on the NVM.

21. The non-transitory computer readable storage medium of claim 16, further comprising instructions that, prior to determining that the electronic device has experienced the safety critical fault, cause the processor to:

determining that the electronic device has experienced an unclassified fault;

in response to determining that the electronic device has experienced the unclassified fault, restarting the electronic device in a mode in which the processor executes the code stored in the ROM, wherein the code stored in the ROM mode checks the NVM for a corrupted memory block;

loading a runtime program into a program memory for execution; and

22. The non-transitory computer readable storage medium of claim 21, further comprising instructions that, in response to determining that the unclassified fault is a safety-critical fault, cause the processor to:

storing an indication of the failure in the NVM; and

damaging a dedicated memory block in the NVM prior to automatically restarting the electronic device.

23. The non-transitory computer-readable storage medium of claim 16, wherein the instructions that cause the processor to determine that the electronic device has experienced a safety critical fault comprise instructions that cause the processor to:

detecting a short circuit condition in the electronic device.

24. The non-transitory computer-readable storage medium of claim 16, wherein the electronic device is an implantable component comprising an implantable battery, and wherein the instructions that cause the processor to determine that the electronic device has experienced a safety critical fault comprise instructions that cause the processor to: